We performed a comparison between Black Duck and Veracode based on real PeerSpot user reviews.
Find out in this report how the two Software Composition Analysis (SCA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The most valuable feature for me in Black Duck is its ability to scan binary files effectively."
"We accidentally use third-party library APIs, which may not be secure. Our technical team may not have the end time or expertise to figure it out. Black Duck helps us with that and saves us time."
"It is able to drill down to the source level."
"The solution is stable."
"The most valuable feature is the vulnerability scanning, and that it's easy to use."
"The solution is very good at scanning and evaluating open source software."
"The knowledge base and the management system are the most valuable features of Black Duck Hub. It has a very helpful management environment. They offer an editor where we can check the discovered license, which is retrieved from their knowledge base. They have a huge knowledge base build over the years. It gives you some possibilities, such as this license with possibility A could cause a vulnerability issue or a potential breach."
"The product enables other applications to be secure."
"Our development team use this solution for static code analysis and pen testing."
"Static Scanning is the most valuable feature of Veracode."
"I like the sandbox, the ability to upload compiled code, and how easy it is."
"Valuable features for us are the static scanning of the software, which is very important to us; the ability to set policy profiles that are specific to us; the software composition analysis, to give us reports on known vulnerabilities from our third-party components."
"To me, the principal feature is the CLI (command-line interface) because I put together a lot of implementations using it. Another important aspect is the low false-positive rate because the solution is very configurable. It is as low as 1 percent and that is a huge difference compared to competitors."
"We have such a wide variety of users for Veracode, including security champions, development leads, developers themselves, that the ease of use is really quite important, because we don't assume anything about what those people might already know, or need to know. It just makes it very useful for anyone who has to engage with it."
"We have found the static analysis to be useful in Veracode Static Analysis. However, we are in the process of testing."
"What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode."
"We have been having some issues with the latest releases where we are not able to scan our applications with the help of Black Duck."
"The tool's documentation and support are areas of concern where improvements are required."
"It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance."
"The solution must provide more open APIs."
"The documentation is quite scattered."
"It needs to be more user-friendly for developers and in general, to ensure compliance."
"The tool needs to improve its pricing. Its configuration is complex and can be improved."
"We're not too sure about the extension of the firewall. It never shows up in the Hub."
"I would like Veracode to add more language support."
"Some important languages are not supported."
"The scanning takes a lot of time to complete."
"There should be more APIs, especially in SCA, to get some results or automate some things."
"The interface is too complex."
"The current version of the application does not support testing for API."
"They cover a lot of languages already and it doesn't make sense for them to cover legacy languages but I know there is a need for covering legacy languages."
"Their scanning engine is sometimes a little bit slow. They can improve the scan time."
Black Duck is ranked 1st in Software Composition Analysis (SCA) with 19 reviews while Veracode is ranked 3rd in Software Composition Analysis (SCA) with 194 reviews. Black Duck is rated 7.8, while Veracode is rated 8.2. The top reviewer of Black Duck writes "Enables applications to be secure, but it must provide more open APIs". On the other hand, the top reviewer of Veracode writes "Helps to reduce false positives and prevent vulnerable code from entering production, but does not support incremental scanning ". Black Duck is most compared with Snyk, Fortify Static Code Analyzer, JFrog Xray, Mend.io and Polaris Software Integrity Platform, whereas Veracode is most compared with SonarQube, Checkmarx One, Fortify on Demand, Snyk and Mend.io. See our Black Duck vs. Veracode report.
See our list of best Software Composition Analysis (SCA) vendors.
We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
